Hermes Agent Releases v0.21.6 with Login Protections and Security Fixes for Automatic Git Operations

Nous Research released Hermes Agent v0.21.6 on October 8, incorporating changes accumulated since the previous version into a stable tag. Engineers deploying the agent service should pay attention to security fixes for dashboard authentication and automatic Git operations; these paths involve the service entry point and the trust boundary when the agent accesses a workspace. Official release notes

The dashboard fixes address four issues: a forged X-Forwarded-For header could bypass per-IP login rate limits; unauthenticated requests could write unbounded values to the authentication audit log; the public /auth/ route lacked a request body size limit; and native login could send a login code to a non-loopback address, potentially leading to session takeover. The release notes credit Tenable Research for reporting all four issues, but do not list the complete range of affected versions. Security fixes

Another fix addresses the risks of the agent invoking Git automatically. Some workspace snapshot, subagent worktree, and cleanup flows read a repository’s own configuration, which could cause its clean, smudge, or process filter programs to run before the first prompt was sent. Git’s official documentation explains that these filters can run external commands when file contents are checked in or checked out; if triggered automatically by the agent, repository configuration can become an entry point for code execution. Git filter documentation

The related merged fix adds a repository-aware Git execution environment that discovers named filters and overrides their commands, and fills in several automatic-operation call sites. The author provided a real-world probe and regression tests for malicious filters and hooks. However, the proposal later received compatibility fixes, so not every rejection condition in the initial proposal should be treated as behavior in the final version. Fix proposal and follow-up links

For deployment, confirm the actual backend version and update path: the official stable and latest Docker images are available; Git installations can run hermes update; desktop and Termux users should wait for the next integrated release. The dashboard can manage API keys and run agent commands, and the official documentation recommends OAuth or self-hosted OIDC for public-facing deployments. Engineering teams should next verify login rate limiting, callback addresses, and Git worktree flows, rather than checking only the version number. Deployment and verification documentation